PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• plugins.trac.wordpress.org/…3751777/disable-payment-method-for-woocommerce Yama
• vulncheck.com/…1.1.10.9-missing-authorization-via-update-fees Üçüncü taraf
• plugins.svn.wordpress.org/…ags/1.1.10.7/public/class-apply-order-fees.php Diğer
• wordpress.org/plugins/disable-payment-method-for-woocommerce Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:11Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-75520Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
• 7,3 CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
• 7,5 CVE-2026-118804Bricks Broken Access Control via query_result Endpoint
• 5,3 CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
• 6,5 CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
• 5,7 CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent